CVE-2026-84999

{
  "etk_id": "ETK-2026-2825",
  "cve_id": "CVE-2026-84999",
  "display_id": "CVE-2026-84999",
  "ghsa_id": "GHSA-356m-cxhj-j59p",
  "euvd_id": "EUVD-2026-111559",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated unrestricted file upload in Pie Register Premium",
  "summary": "Pie Register Premium versions through 3.8.4.0 accept inadequately restricted uploads through an AJAX upload handler. An unauthenticated remote attacker may upload executable content and potentially run code if the uploaded files can be reached and executed by the server.",
  "mitigation": "Disable Pie Register Premium or block public access to its upload handler until a vendor-fixed release is available. Prevent script execution in WordPress upload directories and restrict write access where possible.",
  "vendor": "Pie Register",
  "product": "Pie Register Premium",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 0, <= 3.8.4.0"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Pie Register Premium",
      "purl": null
    }
  ],
  "cwes": [
    434
  ],
  "cvss_score": 9.8,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "upstream",
  "exploit": false,
  "pipeline_minutes": 0.014588866666666667,
  "t0_at": "2026-10-28T02:29:57.638000+00:00",
  "signals": {
    "check": {
      "at": "2026-10-28T03:04:22.284427+00:00",
      "days": 0.02389637068287037,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T02:29:57.638000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-10-28T02:29:57.638000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-28T02:29:57.638000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-84999"
    }
  }
}